New HIPAA privacy laws take effect after grace period for the newly regulated

New Health Insurance Portability and Accountability Act (HIPAA) regulations went into effect Sept. 23, following a grace period intended to give previously unaffected entities time to become compliant. The new rules attempt to improve privacy for personal medical records, tighten the definition of who can access private information and set new standards for what must be done in the event of a security breach.

While HIPAA has been around since 1996, it was reevaluated as part of the Genetic Information Nondiscrimination Act of 2008 and was overhauled during the Recovery and Reinvestment Act of 2009. The former sought to prevent the use of genetic information found in personal health documents from being used as means for denial of service or employment from healthcare providers and employers.

As of January 2013, so-called “covered entities” are responsible for protecting the privacy of patients and customers under HIPAA. Now that the grace period has elapsed, rules expand that same responsibility to “business associates.” “Covered entities” are defined as healthcare providers and insurers whereas “business associates” are defined as any additional personnel who may handle health records.

Regulations impose considerable fines for those that fail to comply, and can also result in criminal charges in the event of extreme negligence. Fines of up to $1 million are now possible within a single calendar year for repeat offenders.

According to The Wall Street Journal, in addition to more detailed definitions of who is responsible for what, the new regulations stipulate that those falling into the “business associates” category will be responsible for conducting risk analysis to discover any potential issues with the way they store sensitive information. They must also get out in front of any risks that may be coming down the pike. The rules will also apply to consultants and other third parties now considered part of the business associate category.

While fines won’t start immediately, the Department of Health and Human Services is expected to start auditing companies shortly. Those who are found to be out of compliance will be required to provide a tactical plan on how they expect to achieve compliance, or they will face the fines laid forth by HIPAA.